Some genus 3 curves with many points * 



Roland Auer^ and Jaap Top^ 

^ Department of Mathematics and Statistics, University of Saskatchewan, 
106 Wiggins Road, Saskatoon, S7N 5E6, Canada 
auerOsnoopy . usask . ca 
^ IWI, Rijksuniversiteit Groningen, 
Postbus 800, NL-9700 AV Groningen, The Netherlands 
topSmath . rug . nl 



Abstract. We explain a naive approach towards the problem of finding 
genus 3 curves C over any given finite field ¥q of odd characteristic, 
with a number of rational points close to the Hasse-Weil-Serre upper 
bound g + 1 + 3[2yg]. The method turns out to be successful at least in 
characteristic 3. 



1 Introduction 
1.1 

The maximal number of rational points that a (smooth, geometrically irre- 
ducible) curve of genus g over a finite field can have, is denoted by Nq{g). 



One has the estimate (see [Scl]) 



in which the notation [r] for r S IR means the largest integer < r. The upper 
bound here is called the Hasse-Weil-Serre bound. 



For g = 1, it is a classical result of Deuring |De], [Wa| that ^"^(1) = q 
1 -|- [2y^], except when q = with p prime and n > 3 odd and p divides 
[2^/^], in which case Nq{l) = q + [2^]. For g = 2 an explicit formula is due 



to J-P. Serre. He stated and proved the result during a course [3e3| he gave 
at Harvard university in 1985; a nice survey including some modifications of 
the original proof can be found in Chapter 5 of the thesis |S^] . The final result 
is that if g is a square and g ^ 4,9 then Nq{2) = q + 1 + 2[2^]. Moreover 
Ng{2) = 20 = 9 1 -h 2[2V9] - 2 and iV4(2) = 10 = A + 1 + 2[2\/4] - 3. In 
case q is not a square, then also Nq{2) = q + \ + 2[2y^] except when either 
gcd(g, [2y^]) > 1 or g can be written in one of the forms + 1, + n + 1 or 

ri^ + n + 2. In these remaining cases, one has that if 2^^ — [2-yg] > ^2^^ then 
Nq{2) =q + 2[2^] and if 2^ - [2^^] < then iV,(2) = q + 2[2^] - 1. 

* It is a pleasure to thank Hendrik Lenstra for his interest in this work, and for his 
remarks which led to Section ^ of this paper. 
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For 5 > 3 no such result is known. The best known lower bounds in case 



3 < 50 and q a power of 2 or 3 which is < 128 can be found in [G-V|. In |3e2, 
§ 4] J-P. Serre gives values of ^^^(3) for q < 19 and for q — 25. Moreover he 
shows in [3e3, p. 64-69] that A'23 — 48. Hence we have the following table. 



q 


2 


3 


4 


5 


7 


8 


9 


11 


13 


16 


17 


19 


23 


25 


27 


29 


31 


32 


37 


41 




7 


10 


14 


16 


20 


24 


28 


28 


32 


38 


40 


44 


48 


56 


56 


60 


> 56 


64 


> 68 


> 72 



The entries for q — 29, 31, 37 are obtained using the technique from the current 
paper; its main goal is to give lower bounds for Nq{3) by restricting ourselves to 
one specific family of curves of genus 3. 



1.2 



Let fc be a field of characteristic different from 2. The plane quartic C\ given by 
x'^ + y^ + z^ = {X + l){x'^y'^ + y'^z'^ + z'^x'^) is for A e fc with A 9^ —3, 1,0 a geomet- 
rically irreducible, smooth curve of genus 3. The degree 4 polynomials given here 
are fixed by the subgroup G < PGL(3, fc) generated by a : {x,y,z) 1-^ {y,z,x) 
and T : {x,y,z) 1-^ {y,—x,z). The group G is isomorphic to S'4, the symmetric 
group on 4 elements. Hence G is contained in the group of automorphisms of 
C\. For general A the automorphism group of C\ in fact equals G. 

These curves occur in the classification of non-hyperelliptic genus 3 curves 
with nontrivial automorphism group, as given in jHe, p. 2.88] and in | |V^ , Ta- 
ble 5.6, pp. 63-64]. 

Suppose A 7^ 0, 1. By Ex we denote the elliptic curve given by the equation 
= x{x — l){x — \). If moreover A ^ —3 then we write E^^^^^ for the elliptic 

curve with equation (A + 3)j/^ — x{x — l){x — A). The relation with the curves 

Cx is as follows. 

Lemma 11 Suppose k is a field of characteristic different from 2 and A G fc \ 
{0, 1, —3}. Then the jacobian of the curve Gx given by x'^+y^+z'^ = (A-|-l)(x^y^-|- 
y^z^ -|- z^x^) is over k isogenous to the product e''^^^^ x E^^^^"^ x E^^^\ where 



E 



(A+3) 



denotes the elliptic curve with equation (A 4- 3)y^ — x{x — l)(x — A). 



Proof. Most of this is shown in |To, pp. 40-41]; one takes the quotient of Gx 
by the involution {x,y,z) 1-^ {—x,y,z). The resulting curve has genus 1 and it 
admits an involution without any fixed points. Taking the quotient again results 
in an elliptic curve, given by y'^ = x^ + 2(A + 1)(A + 3)x'^ -I- (A - 1) (A -I- 3)x. The 
2-isogeny with kernel generated by (0, 0) maps this curve onto e''^^^^ (compare 



the formulas for 2-isogenies as given in |Si-T, HI § 4] 
for the composition of all maps described here. Then 



Write TT : Gx 



E 



(A+3) 



p ^ (7r,7rcr,7rcr^) : Gx 



^(A+3) ^ ^(A+3) ^ ^(A+3) 



where a : [x,y,z) 1— > (i/,z,x) is one of the automorphisms of Cx- The fact that 
p induces an isomorphism between the spaces of regular 1-forms implies that p 
induces an isogeny between Jac(CA) and the triple product of e'^~^^\ □ 
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Corollary 12 With notations as above, one finds for A G with q odd and 
A 7^ 0, 1,-3 that 

Proof. It is a well known fact that ^C\{¥q) equals q + 1 — where t is the trace 



of Frobenius acting on a Tate module of Jac(CA). Lemma 11 implies that this 



Tate module is isomorphic to a direct sum of three copies of the Tate module of 
E^'-y^^'^ . Hence t = it' where t' is the trace of Frobenius on the Tate module of 
E^^^^\ Since this trace equals g + 1 — #£'^'^^"^^ (Fg), the result follows. □ 



1.3 

Our strategy for finding a curve of genus 3 over a finite field with odd charac- 
teristic should now be clear: find A such that +^^(F,) is as large as possible 
and use Corollary |lj. This works quite well for small q, using a direct search. 
In fact, as will be explained in Section ^ below, it is not even necessary here to 
calculate #i;^^+^^(F<,) for many values A € Fg. 

We obtain a general result when the characteristic of F^ equals 3, because in 
that case we deal with a curve E^^^ which is isomorphic to the curve E^ with 



jjL = 1/A. Since it is precisely known which values ^f^E^iFq) attains (see |A-T | and 



also Section^ below), one obtains a nice explicit lower bound for N^n (3). In fact, 
the result implies that the difference between A^a^ (3) and the Hasse-Weil-Serre 
bound is bounded independently of n: 

Proposition 13 For every n > I the inequality 

{0 if n=2 mod 4; 
12 if n = mod 4; 
21 if n= \ mod 2 

holds. 

For the proof we refer to Section H. Note that this proves a special case of a 



conjecture of J-P. Serre |Se3, p. 71], which says that for all q the difference 



g + 1 + 3 [2^] — Nq{2,) should be bounded independently of q. 



1.4 

In characteristic at least 5 we have not been able to obtain a general result 
such as given in Proposition O. However, the fact that a curve is either 



isomorphic to E\ or it is a quadratic twist of Ex, implies (again using | A-Tf ) 



that for every finite field F^ of odd characteristic, a curve C\ as above exists for 
which ^C{¥q) is at most 21 off from either the Hasse-Weil-Serre upper bound 
g -I- 1 -I- 3 [2y/q] , or from the analogous lower bound 9-1-1 — 3 [2^] . This is proven 
in Section ^. We note that a sharper result of the same kind (with 21 replaced 
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by 3) was obtained by Kristin Lauter |Lau|, Lau-Se| using an entirely different 
metliod. 

As Everett Howe pointed out to us, it is in fact possible to improve our result 



slightly by replacing the product E^^^'^ x E'^^''' x E''^^'^' we use, by a product 
E X E X E\ in which E/¥q is an elliptic curve with a rational point of order 2 and 
^E{¥q) maximal under that condition, and Ex/¥q is a Legendre elliptic curve 
over ¥q with as many rational points as possible. The result of Everett Howe, 
Franck Leprevost and Bjorn Poonen |H-L-P, Prop. 15] in this case implies that 
either this product or its standard quadratic twist is isogenous over to the 
jacobian of a smooth genus 3 curve over F^. It may be noted that the estimate 
obtained in this way is in general still weaker than Lauter's result (it replaces 
our 21 by 9 instead of by 3). 



(A+3) 



i.(A+3) 



2 A characterization of Legendre elliptic curves 

Suppose X is a field of characteristic ^ 2, and E/K is an elliptic curve. We 
will say that E/K is a Legendre elliptic curve over K if there is a A 7^ 0, 1 in 
K such that E is over K isomorphic to E\ given by j/^ — x{x — l){x — A). A 
necessary but in general not sufficient condition for an elliptic curve E/K to he 
a Legendre elliptic curve over K is that all points of order 2 on i? are iiT-rational. 
An intrinsic description of Legendre elliptic curves is given as follows. Take a 
separable closure K^°p of K and write Gk = Ga,l{K^°'^ / K) for its Galois group. 

Lemma 21 The statements 

1. E is a Legendre elliptic curve over K ; 

2. E can be given by an equation = {x — a)(x — b){x — c) in which at least 
one o/±(a — 6),±(6 — c),±(c— a) is a square in K* ; 

3. E has all its points of order 2 rational over K , and there exists a point 
P e E{K'"'P)['i] such that -P is not m the GK-orbit of P. 

are equivalent. 

Proof. The equivalence of (1) and (2) is easy. To verify that (2) and (3) are 
equivalent, suppose (after possibly permuting a, b, c) that a — 6 is a square and 
that E is given by = {x - a){x -b){x- c). The point Tf, = (6,0) in E{K) 
has order 2, and the quotient E' := E/{Th) admits an isogeny of degree 2: 
(fi : E' E defined over K (the dual isogeny of the quotient map). A very well 



known property (compare | Si-T , III § 5]) of ip is that the image (p{E'{K)) C 
E{K) equals the kernel of the homomorphism E{K) K* /K*^ defined by 
Tft I— > (6 — a){b ~ c) and {x,y) i~+ x ~b for all {x,y) G E{K) with {x,y) ^ Tf,. 
Hence the condition that a — 6 be a square is equivalent with the property that 
the point Ta := (a, 0) S E{K) is in the image of E'{K). This means precisely that 
a pair of points {P, P + Tt} C E exists which is G^-stable, and 2P = Ta. Hence 
P is a point of order 4 on E, and for all a e Gk we have a{P) — P £ {O, Tf,}. 
In particular cr(P) ~ P ^ 2P, which means (t(P) 7^ — P for all a £ Gk- 
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Vice versa, suppose given a point P of order 4 with the property (t{P) ^ —P 
for aU (T e Gk- Since aU 2-torsion of E is X-rational, we have that (j{P) — P G 
E{K)[2] and moreover the condition <j{P) 7^ —P imphes that a{P) — P is in a 
cycHc subgroup of E{K)[2] which is independent of a. Hence we have points T 
and 2P of order 2, where {P, P + T} is G^-stable. As we have seen, this imphes 
the statements (1) and (2). □ 

Corollary 22 Suppose q is a power of an odd prime and E/¥q is an elliptic 
curve. Let tt € End(i?) be the Frobenius endomorphism (raising coordinates to 
the power q). Then E is a Legendre elliptic curve over ¥q if and only z/tt + 1 e 
2 End(£;) butTT + l<^A End{E) . 

Proof. The Galois group Gr^ is topologically generated by the q-th power map, 
and this generator acts on E via the endomorphism tt. The condition vr + 1 G 
2 End(£') is equivalent with the statement that E has all its points of order 2 
rational over F^. In the same manner, the condition tt + 1 ^ 4End(i?) precisely 
means that a point P of order 4 exists, with the property 7r(P) ^ —P. Since 
the Galois group Gf, acts on iJ(Fq)[4] via a (cychc) subgroup of the kernel of 

GL2(Z/4Z)"^^GL2(Z/2Z), it follows that a{P) ^ -P for all ct e Gp,. Hence 
Lemma |2^ implies that i? is a Legendre elliptic curve over . 

Vice versa, if i? is a Legendre elliptic curve over F^, then by Lemma ^ we 
know that P G i?(Fg)[4] exists with tt{P) 7^ — P, which implies that tt + 1 is not 
divisible by 4 in End(P). Wc have that tt + 1 e 2End(i?) since vr acts trivially 
on all points of order 2. 

This proves the corollary. □ 

Proposition 23 An elliptic curve E/¥q (with q odd) for which ^E{¥q) e 4Z 
is isogenous to a Legendre elliptic curve over ¥q, except in the following case: 
q^r'^ with r e 1 + 4Z, and #E{¥q) =q + l + 2r. 



Proof. (This result was first presented in |A-T], however, with a somewhat dif- 
ferent proof. The present proof is more conceptual, but it gives less information 
concerning the possible values of Legendre parameters A in the supersingular 
case.) 

Let TT G End(£') be the (g-th power) Frobenius. The proof considers two 
cases. 

First, suppose tt = r e Z. Then q = dcg(7r) = r^ and fj^E(¥q) = (r — 1)^. Any 
curve E' isogenous to E then also satisfies ^E'iVq) — (r — 1)^ and Frobenius 
in End(£") is equal to r. By Corollary |22[ one (and equivalently, all of them) 
such curve E' is a Legendre elliptic curve over F^ precisely when r + 1 is even, 
but not divisible by 4. The latter condition is equivalent with r = 1 mod 4. This 
proves the statement in the case tt G Z. 

If TT ^ Z then Z[7r] C End(i?) is an order in the ring of integers of an 
imaginary quadratic field K. We have that ^E(Fq) = (1 — 7r)(l — tt) where 
the bar denotes complex conjugation in K. The condition ^E{¥q) = mod 4 
implies that (1 — 7r)/2 is integral. Now consider the order A :— Z[(l + 7r)/2]. 
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By construction, tt G A satisfies tt + 1 e 2A and tt + 1 ^ 4^4. It is a result of 
Waterhouse [Wa, Thm. 4.5] (compare [3ch, p. 194] where a mistake in the original 
result is corrected), that a curve E' /¥q exists with an isomorphism End{E') = A 
such that under this isomorphism Frobenius on E' corresponds to tt e v4. This 
implies in particular that ^E'{¥q) = ^E{¥q) and hence E' and E are isogenous. 
Moreover, using Corollary ^ we know that E' is a Legendre elliptic curve over 
¥g. This proves the proposition. □ 



3 Characteristic 3 



We will now prove Proposition 13, Take n > 1 and write q :— 3", m : — [ 2^/g] 
and q+l + m = N + r with iV £ 4Z and < r < 3. As explained in ( |l.3| ), we 
will examine how close to the upper bound q + 1 + m the number of Fg-points 
on a Legendre elliptic curve i^i/A — e'^^^ can be, for A G F^. 

If n is odd and moreover = 1 mod 3 (the smallest n where this is the 
case, is n = 11 which gives m — 841 and N — 3^^ + 1 + 840), then we replace 
A'' by A' — 4. The resulting number A^ satisfies q + 1 — 'm<N<q+l + m, 
and moreover we know from [Pj ] that E/¥q exists with ^E{¥q) = N. li n is 
odd, then Proposition ^ implies the existence of A S F^ with ^E^^\¥q) = N. 
Hence Corollary |2| yields a genus 3 curve C\ with :^C\{¥q) — 3N ~ 2q~2. In 
particular, this shows that 

q + l + 3m~ Nq{3) <q + l + 3m-3N + 2q + 2 = 3r+12<21 

for odd n (in fact, even < 3r < 9 unless m is divisible by 3). 

If n is even, then m = 2 • 3"/^ and (a gain using Deuring's results |Dd]) an 
elliptic curve E/¥q exists with 4t^E{¥q) = q + 1 -\- m. By Proposition g^, this 
number of points occurs for a Legendre elliptic curve only in case m/2 = 3 mod 4, 
i.e., when n = 2 mod 4. Hence under this condition we obtain a curve C\ whose 
number of points attains the Hasse-Weil-Serre bound. 

In the remaining case we have n = mod 4. Here the number q + 1 + m 
does not occur as #i?^A)(Fg), for any A G Fg. Hence we take the largest smaller 
possibility, which is q+l + m — 4. Proposition ^ implies that a Legendre elliptic 
curve with this number of points over F^ indeed occurs. It follows that a genus 3 
curve Cx/¥q exists with i^Cx{¥q) = 3{q+l + m- 4) -2q-2 = q + 1 + 3m- 12. 
This implies the inequality given in Proposition |l^. □ 



4 Examples in characteristic > 3 

The problem which arises when one attempts to adapt the argument presented 
in Section ^ to finite fields of characteristic > 3, can already be seen in the 
following result. 

Proposition 41 Suppose q is a power of a prime p > 3, and m [2^]. Over 
¥q, a curve C\ of genus 3 exists such that either ^C\{¥q) > q+1 + 3m — 21 or 
#Cx{¥q) < (z + l-3m + 21. 
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As we mentioned in the introduction, a somewhat stronger result has been ob- 



tained by Kristin Lauter |Lau|, |Lau-Se| using quite different techniques. More- 



over a variant of our proof may be obtained by using a result of Everett Howe, 



Franck Leprevost and Bjorn Pooncn [H-L-P, Prop. 15] 



Proof. Write g + l + m = N + r with iV G 4Z and < r < 3. Then one 
of iV, 2q + 2 — occurs as the number of points on a Legendre elliptic curve 
Ex/¥q, except possibly when r > and p divides m — r. In that case, we replace 
N hy N' :^ N — A and we obtain a number of points which does occur. 

This gives us an elliptic curve Ex. The corresponding curve E^'^^^ has either 
N or N' points, or in case A + 3 is not a square in ¥q this number is 2q + 2 — N 
or 2q + 2~ N' . Since this number is at distance at most 7 from one of q + 1 ± m. 
Corollary |l^ implies the result. □ 

Proposition 42 Suppose p = 3 mod A is a prime number, n > 1 is an odd 
integer and q — p^". Then Nq{3) = q + 1 + 6p" equals the Hasse-Weil-Serre 
bound. 



Proof. Take A = — 1 e Fp. Since p = 3 mod 4, the elliptic curve E\/Fp is 
supersingular. This impHes ^E\i¥p) = p + 1 (in case p = 3, this follows from 
the fact that the number of points is a multiple of 4, and also of course from a 
direct calculation). One concludes that ^f'ExiVq) = g + 1 + 2p". Since A + 3 7^ 

as an element of Fp is a square in Fg, the two curves Ex and E^^^ are isomorphic 
over Fg. Corollary ^ therefore yields that the genus 3 curve Cx attains the 
Hasse-Weil-Serre bound over ¥q. □ 

Note that the genus 3 curve used in the above proposition is in fact the 
famous Fermat quartic. Hence the result is probably well known. 



4.1 

In practice, a fairly efficient method to find A S F, for which ^E'^^^^' (F,) equals 
a given number N = mod 4 can be given in case q = p a prime or q ~ p^ the 
square of a prime. This works as follows. Write N = q + 1 — t. 

We first treat the case q = p^ and t — zt2p. Exactly one of the two numbers 
p^ + l±2p occurs as a number of points of a Legendre elliptic curve over Fp2 , 
and this number is attained in our family precisely for the supersingular A 7^ —3 
such that A -|- 3 is a square in Fp2 ; the number with the opposite choice of sign 
occurs for the ones such that A 4- 3 is a nonsquare. 

In the remaining cases, the Hasse inequality tells us \t\ < 2^. Hence we 
find t exactly if we know t mod 4p. Now t mod 4 is already known, hence it 
suffices to find a A such that (F,) = q + I — t mod p. If we write x '■ 

F* ^ ±1 for the nontrivial character with kernel F*'^, this means we look for 
A ^ -3 such that #Ex{¥q) = 1 - x(A + 3)i. It is well known V § 4] that 
i^ExiVq) = 1- ((-l)(P-l)/2^p(A))^ with e ^ I a q = p and e = 1+p if q = p^. 

Here -ffp(A) = X]i=o^^^^ 1^^^^) so-called Hasse polynomial, whose 
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coefficients can be computed using an easy recursion. Hence in case q = pwe have 
to solve Hp{\) = zLt for A S ¥p, and then check whether x(A + 3) has the correct 
value. Similarly, when q = we look for solutions in Fg of Hp{\)Hp{\P) = ±t. 
This works reasonably efficient for -say- q < 10^. 

4.2 

Using the package KANT, we tested which values ^E{¥q) = mod 4 occur for 
the curves E^^^^^ /¥q, for all odd q < 100000. It turns out that for most g, all 
values are attained. In the table below, we list all q < 100000 where this is not 
the case, and for each of them the missing valuc(s) ^E{¥g). As can be seen 
from the data, usually there is only one such missing value, which moreover is 
always one of the minimal or the maximal possible number = mod 4 in the 
interval [g -|- 1 — [2^], q + 1 + [2^^]] . Wo list a sign ± indicating which of these 
possibilities occurs for a missing value. There are exactly two exceptional cases 
for q < 100000. The first one is q = 7^: here two values don't occur, namely the 
maximum 2500 = 7"* + 1 + 2 • 7^ and also 2396 = 7"* + 1 - 6. The other one is 
g = 5^. The two values missing here are the minimal one 5^ -|- 1 — 2 • 5^ and also 
15380 = q + l- 2y/q + 4. The following table gives all other q < 100000 with a 
missing value. 



q 


± 


q 


± 


q 


± 


q 


± 


q 


± 


q 


± 


q 


± 


q 


± 


5 


+ 


7 




3' 




13 




19 




5' 




72 




67 


1 


34 


+ 


53 




132 




173 


+ 


293 


+ 


73 




487 




232 




54 


+ 


3^^ 




733 




787 


+ 


907 


+ 


2503 


+ 


3253 


+ 


4493 




4903 




5333 


+ 


5479 




5779 




38 


+ 


7573 




9413 


+ 


10639 




11239 




11243 


+ 


12547 




114 


+ 


14887 




17959 


+ 


18773 


+ 


23719 


+ 


24967 




25603 




27893 




134 


+ 


31687 




33287 


+ 


33493 




37253 


+ 


42853 




46663 




51991 


+ 


52903 




58567 


+ 


310 




64013 


+ 


65539 


+ 


67()07 


+ 


71293 




7G733 


+ 


17^ 


+ 


85853 


+ 


92419 


+ 


94253 




99859 





The table shows that for all but 30 values q < 100000, the maximal value of 

i^C\{Fg) equals q + l + 3t, where g -|- 1 + 1 = mod 4 is the maximal number of 
points of an elliptic curve over with all its points of order 2 rational. 

Whenever the Hasse-Weil-Serre bound is divisible by 4, we may be in the 
lucky circumstance that it is reached using our family of curves. This hap- 
pens quite frequently, for instance when q equals any of the primes 19, 29, 53, 
67, 71, 89, 103, 107, 151, .... In the case q = 173 the bound q + 1 + 3m is a 
multiple of 4, but as the table above shows, our curves do not attain it. 

The data seems to indicate that for much more than 50% of the prime powers 
q, all possible values Nq = mod 4 are attained by the family e{^~^^\ Moreover, 
the only occurrences of a g for which more than one value is missing, happened 
at 'high' even powers of a prime number. We have no theoretical explanation 
for this. A numerical test over all q = p^" < 10^ revealed exactly one more case 
where two values are missing, namely at g = 7^. We have also not been able to 
explain why in all cases where we found that exactly one value is missing, this 
missing value is one of the maximal or minimal number of points. 
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